Inferring Changes in Daily Human Activity from Internet Response

Inferring Changes in Daily Human Activity from Internet Response. Song, X., Baltra, G., & Heidemann, J. In Proceedings of the ACM Internet Measurement Conference, pages to appear, Montreal, QC, Canada, October, 2023. ACM.

Paper doi abstract bibtex

Network traffic is often diurnal, with some networks peaking during the workday and many homes during evening streaming hours. Monitoring systems consider diurnal trends for capacity planning and anomaly detection. In this paper, we reverse this inference and use \emphdiurnal network trends and their absence to infer human activity. We draw on existing and new ICMP echo-request scans of more than 5.2M /24 IPv4 networks to identify diurnal trends in IP address responsiveness. Some of these networks are \emphchange-sensitive, with diurnal patterns correlating with human activity. We develop algorithms to clean this data, extract underlying trends from diurnal and weekly fluctuation, and detect changes in that activity. Although firewalls hide many networks, and Network Address Translation often hides human trends, we show about 168k to 330k (3.3–6.4% of the 5.2M) /24 IPv4 networks are change-sensitive. These blocks are spread globally, representing some of the most active 60% of \twotwodegree geographic gridcells, regions that include 98.5% of ping-responsive blocks. Finally, we detect interesting changes in human activity. Reusing existing data allows our new algorithm to identify changes, such as Work-from-Home due to the global reaction to the emergence of Covid-19 in 2020. We also see other changes in human activity, such as national holidays and government-mandated curfews. This ability to detect trends in human activity from the Internet data provides a new ability to understand our world, complementing other sources of public information such as news reports and wastewater virus observation.

@InProceedings{Song23a,
        author =        "Xiao Song and Guillermo Baltra and John Heidemann",
        title =         "Inferring Changes in Daily Human Activity from Internet Response",
        booktitle =     "Proceedings of the " # "ACM Internet Measurement Conference",
        year =          2023,
	sortdate = "2023-10-26",
	project = "ant, eieio, internetmap, minceq",
	jsubject = "network_topology",
        pages =      "to appear",
        month =      oct,
        address =    "Montreal, QC, Canada",
        publisher =  "ACM",
        jlocation =   "johnh: pafile",
        keywords =   "internet, address scans, covid-19, poster, trinocular",
	url =		"https://ant.isi.edu/%7ejohnh/PAPERS/Song23a.html",
	pdfurl =	"https://ant.isi.edu/%7ejohnh/PAPERS/Song23a.pdf",
	blogurl = "https://ant.isi.edu/blog/?p=1998",
	dataseturl =	"https://ant.isi.edu/datasets/ip_accumulation/",
        doi =        "https://doi.org/10.1145/3618257.3624796",
	abstract = "Network traffic is often diurnal, with some networks peaking during
the workday and many homes during evening streaming hours.  Monitoring
systems consider diurnal trends for capacity planning and anomaly
detection.  In this paper, we reverse this inference and
use \emph{diurnal network trends and their absence to infer human activity}.
We draw on existing and new ICMP echo-request scans of
more than 5.2M /24 IPv4 networks to identify diurnal trends in IP
address responsiveness.  Some of these networks 
are \emph{change-sensitive}, with diurnal patterns correlating with human
activity.  We develop algorithms to clean this data, extract
underlying trends from diurnal and weekly fluctuation, and detect
changes in that activity.  Although firewalls hide many networks, and
Network Address Translation often hides human trends, we show about
168k to 330k (3.3--6.4\% of the 5.2M) /24 IPv4 networks are
change-sensitive.  These blocks are spread globally, representing some
of the most active 60\% of \twotwodegree geographic gridcells, regions
that include 98.5\% of ping-responsive blocks.  Finally, we detect
interesting changes in human activity.  Reusing existing data allows
our new algorithm to identify changes, such as Work-from-Home due to
the global reaction to the emergence of Covid-19 in 2020.  We also see
other changes in human activity, such as national holidays and
government-mandated curfews.  This ability to detect trends in human
activity from the Internet data provides a new ability to understand
our world, complementing other sources of public information such as
news reports and wastewater virus observation.",
}

Downloads: 0

{"_id":"vhJhyWafYGB3AsE8T","bibbaseid":"song-baltra-heidemann-inferringchangesindailyhumanactivityfrominternetresponse-2023","author_short":["Song, X.","Baltra, G.","Heidemann, J."],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","author":[{"firstnames":["Xiao"],"propositions":[],"lastnames":["Song"],"suffixes":[]},{"firstnames":["Guillermo"],"propositions":[],"lastnames":["Baltra"],"suffixes":[]},{"firstnames":["John"],"propositions":[],"lastnames":["Heidemann"],"suffixes":[]}],"title":"Inferring Changes in Daily Human Activity from Internet Response","booktitle":"Proceedings of the ACM Internet Measurement Conference","year":"2023","sortdate":"2023-10-26","project":"ant, eieio, internetmap, minceq","jsubject":"network_topology","pages":"to appear","month":"October","address":"Montreal, QC, Canada","publisher":"ACM","jlocation":"johnh: pafile","keywords":"internet, address scans, covid-19, poster, trinocular","url":"https://ant.isi.edu/%7ejohnh/PAPERS/Song23a.html","pdfurl":"https://ant.isi.edu/%7ejohnh/PAPERS/Song23a.pdf","blogurl":"https://ant.isi.edu/blog/?p=1998","dataseturl":"https://ant.isi.edu/datasets/ip_accumulation/","doi":"https://doi.org/10.1145/3618257.3624796","abstract":"Network traffic is often diurnal, with some networks peaking during the workday and many homes during evening streaming hours. Monitoring systems consider diurnal trends for capacity planning and anomaly detection. In this paper, we reverse this inference and use \\emphdiurnal network trends and their absence to infer human activity. We draw on existing and new ICMP echo-request scans of more than 5.2M /24 IPv4 networks to identify diurnal trends in IP address responsiveness. Some of these networks are \\emphchange-sensitive, with diurnal patterns correlating with human activity. We develop algorithms to clean this data, extract underlying trends from diurnal and weekly fluctuation, and detect changes in that activity. Although firewalls hide many networks, and Network Address Translation often hides human trends, we show about 168k to 330k (3.3–6.4% of the 5.2M) /24 IPv4 networks are change-sensitive. These blocks are spread globally, representing some of the most active 60% of \\twotwodegree geographic gridcells, regions that include 98.5% of ping-responsive blocks. Finally, we detect interesting changes in human activity. Reusing existing data allows our new algorithm to identify changes, such as Work-from-Home due to the global reaction to the emergence of Covid-19 in 2020. We also see other changes in human activity, such as national holidays and government-mandated curfews. This ability to detect trends in human activity from the Internet data provides a new ability to understand our world, complementing other sources of public information such as news reports and wastewater virus observation.","bibtex":"@InProceedings{Song23a,\n author = \"Xiao Song and Guillermo Baltra and John Heidemann\",\n title = \"Inferring Changes in Daily Human Activity from Internet Response\",\n booktitle = \"Proceedings of the \" # \"ACM Internet Measurement Conference\",\n year = 2023,\n\tsortdate = \"2023-10-26\",\n\tproject = \"ant, eieio, internetmap, minceq\",\n\tjsubject = \"network_topology\",\n pages = \"to appear\",\n month = oct,\n address = \"Montreal, QC, Canada\",\n publisher = \"ACM\",\n jlocation = \"johnh: pafile\",\n keywords = \"internet, address scans, covid-19, poster, trinocular\",\n\turl =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Song23a.html\",\n\tpdfurl =\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Song23a.pdf\",\n\tblogurl = \"https://ant.isi.edu/blog/?p=1998\",\n\tdataseturl =\t\"https://ant.isi.edu/datasets/ip_accumulation/\",\n doi = \"https://doi.org/10.1145/3618257.3624796\",\n\tabstract = \"Network traffic is often diurnal, with some networks peaking during\nthe workday and many homes during evening streaming hours. Monitoring\nsystems consider diurnal trends for capacity planning and anomaly\ndetection. In this paper, we reverse this inference and\nuse \\emph{diurnal network trends and their absence to infer human activity}.\nWe draw on existing and new ICMP echo-request scans of\nmore than 5.2M /24 IPv4 networks to identify diurnal trends in IP\naddress responsiveness. Some of these networks \nare \\emph{change-sensitive}, with diurnal patterns correlating with human\nactivity. We develop algorithms to clean this data, extract\nunderlying trends from diurnal and weekly fluctuation, and detect\nchanges in that activity. Although firewalls hide many networks, and\nNetwork Address Translation often hides human trends, we show about\n168k to 330k (3.3--6.4\\% of the 5.2M) /24 IPv4 networks are\nchange-sensitive. These blocks are spread globally, representing some\nof the most active 60\\% of \\twotwodegree geographic gridcells, regions\nthat include 98.5\\% of ping-responsive blocks. Finally, we detect\ninteresting changes in human activity. Reusing existing data allows\nour new algorithm to identify changes, such as Work-from-Home due to\nthe global reaction to the emergence of Covid-19 in 2020. We also see\nother changes in human activity, such as national holidays and\ngovernment-mandated curfews. This ability to detect trends in human\nactivity from the Internet data provides a new ability to understand\nour world, complementing other sources of public information such as\nnews reports and wastewater virus observation.\",\n}\n\n\n","author_short":["Song, X.","Baltra, G.","Heidemann, J."],"bibbaseid":"song-baltra-heidemann-inferringchangesindailyhumanactivityfrominternetresponse-2023","role":"author","urls":{"Paper":"https://ant.isi.edu/%7ejohnh/PAPERS/Song23a.html"},"keyword":["internet","address scans","covid-19","poster","trinocular"],"metadata":{"authorlinks":{}}},"bibtype":"inproceedings","biburl":"https://bibbase.org/f/dHevizJoWEhWowz8q/johnh-2023-2.bib","dataSources":["fxEParwu2ZfurScPY","7nuQvtHTqKrLmgu99"],"keywords":["internet","address scans","covid-19","poster","trinocular"],"search_terms":["inferring","changes","daily","human","activity","internet","response","song","baltra","heidemann"],"title":"Inferring Changes in Daily Human Activity from Internet Response","year":2023}